<!DOCTYPE html>
<html>
<head>
<p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=71229 (V8MessageEvent::dataAccessorGetter does not return a reference to its caller). If it succeeds, DONE will appear below. If it fails, you should see messages containing unexpected strings that were received and/or a renderer crash.
<hr>
<pre id=log></pre>
<script>
function log(message)
{
    document.getElementById("log").innerHTML += message + "<br>";
}

var eventTarget;

// Make a long prefix string. This seems to make it more likely that a use-
// after-free problem will cause an observable error.
var kPrefix = "Hello";
for (var i = 0; i < 10; ++i)
    kPrefix += kPrefix;
var num = 0;
var endNum = 1000;
function HandleMessage(message_event) {
    if (message_event.data !== kPrefix + num.toString()) {
        log("Expected '" + num + "', Got: '" + message_event.data + "'");
    }
    if (num == endNum) {
        testRunner.notifyDone();
    }
    else {
        ++num;
        setTimeout(SendString, 0);
    }
}

function SendString() {
    var target = document.getElementById("event_target");
    var message_event = window.document.createEvent('MessageEvent');
    message_event.initMessageEvent('message',  // type
                                   false,  // canBubble
                                   false,  // cancelable
                                   kPrefix + num.toString(),  // data
                                   '',  // origin [*]
                                   '',  // lastEventId
                                   null,  // source [*]
                                   []);  // ports
    target.dispatchEvent(message_event);
}

function AddListener() {
    var target = document.getElementById("event_target");
    target.addEventListener("message", HandleMessage, false);
    SendString();
}
document.addEventListener("DOMContentLoaded", AddListener, false);

if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
log("DONE");

</script>
</head>
<body>
<div id="event_target"></div>
</body>
</html>